Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 ⚠️ This exploit is for defensive purposes and s...

CVE-2023-5041

The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database...

CVE-2023-5041

The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database...

CVE-2023-5041

The CVE-2023-5041 entry concerns the Track The Click WordPress plugin (versions before 0.3.12). Root cause: improper sanitization of query parameters to the stats REST endpoint, enabling a time-based blind SQL injection in database queries when accessed by an authenticated user with author role o...

CVE-2023-5041 Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection

The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database...

PT-2024-13936 · WordPress · Track The Click

Name of the Vulnerable Software and Affected Versions: The Track The Click WordPress plugin versions prior to 0.3.12 Description: The issue arises from the plugin's failure to properly sanitize query parameters to the stats REST endpoint before using them in a database query. This allows a...

WordPress Plugin Track The Click Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

GitLab warns zero-click vulnerability could lead to account takeovers

GitLab has issued a warning about a critical vulnerability in GitLab Community Edition CE and Enterprise Edition EE. GitLab is an online DevOps platform that allows developers to collaborate on creating software. Organizations have a choice to install GitLab on their own servers or under GitLab’s...

CVE-2023-6632 Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting

The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 versions up to 2.9.1.1 in Happy Addons for Elementor Pro due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-52197

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0...

CVE-2023-52197

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0...

CVE-2023-52197

CVE-2023-52197 : A stored XSS vulnerability exists in the WordPress plugin Ads Invalid Click Protection (versions

CVE-2023-52197 WordPress Ads Invalid Click Protection Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0...

PT-2024-14464 · Impactpixel · Impactpixel Ads Invalid Click Protection

Name of the Vulnerable Software and Affected Versions: Impactpixel Ads Invalid Click Protection versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that...

WordPress Plugin Ads Invalid Click Protection Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2024-13949 · Unknown · Xiweicheng Tms

Name of the Vulnerable Software and Affected Versions: xiweicheng TMS version 2.28.0 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted script to the click here function. This enables the attacker to perform unauthorized actions on the...

WordPress Ads Invalid Click Protection Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Ads Invalid Click Protection Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52197 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a7109297a3e8 Credits Dhabaleshwar Das Required...

Mozilla: Clickjacking permission prompts using the popup transition

The Mozilla Foundation Security Advisory describes this flaw as: The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the...

RHEL 9 : firefox (RHSA-2024:0025)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0025 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Zero-Click Outlook RCE Exploitation Chain in Windows

Summary: Two vulnerabilities CVE-2023-35384 and CVE-2023-36710 in Microsoft Windows can be chained to achieve remote code execution RCE on vulnerable Outlook clients. Attackers can exploit these flaws by sending a crafted email with a custom notification sound file to trigger the download of a...